CVEs published September 19, 2023
56 CVEs were published on September 19, 2023: 4 critical, 18 high. 2 are now in CISA KEV.
- Published
- 56
- Critical
- 4
- High
- 18
- Medium
- 13
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 2
- Fix available
- 26
Most affected products
- Ormazabal ekorCCP · Ormazabal ekorRCI
- 6
- Fujitsu Arconte Áurea
- 5
- mastodon
- 3
- Nozomi Networks Guardian · Nozomi Networks CMC
- 3
- JetBrains TeamCity
- 2
- Apache Software Foundation Apache Flink Stateful Functions
- 1
- Atlassian Bitbucket Data Center · Atlassian Bitbucket Server
- 1
- blamer
- 1
- github.com/nats-io/nats-server · github.com/nats-io/nats-se…
- 1
- GitLab
- 1
Critical 4
- CVE-2023-42793In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possibleJetBrains TeamCity
- CVE-2022-47558Improper Access Control in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2022-47555Improper Neutralization of Special Elements in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2023-0773Unauthorized Access Control Vulnerability in Uniview IP CameraUniview IP Camera IPC322LB-SF28-A
High 18
- CVE-2023-22513This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server.Atlassian Bitbucket Data Center · Atlassian Bitbucket Server
- CVE-2023-42451Mastodon Invalid Domain Name Normalization vulnerabilitymastodon
- CVE-2023-42447blurhash panics on parsing crafted inputswhisperfish blurhash-rs · blurhash
- CVE-2023-42444phonenumber panics on parsing crafted RF3966 inputswhisperfish rust-phonenumber · phonenumber
- CVE-2023-41890Sustainsys.Saml2 Insufficient Identity Provider Issuer ValidationSustainsys Saml2 · Sustainsys.Saml2 +1
- CVE-2023-41179A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security anTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2023-4096Weak password recovery mechanism vulnerability in Fujitsu Arconte ÁureaFujitsu Arconte Áurea
- CVE-2022-47559Cross-Site Request Forgery in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2023-4092SQL injection vulnerability in Fujitsu Arconte ÁureaFujitsu Arconte Áurea
- CVE-2022-47554Exposure of Sensitive Information in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2022-47553Improper Authorization in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2023-32649DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-29245SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-2567Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-32184A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user thopensuse-welcome
- CVE-2023-32186A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supSUSE RKE2 · github.com/rancher/rke2
- CVE-2023-5009Incorrect Authorization in GitLabGitLab
- CVE-2023-5060Cross-site Scripting (XSS) - DOM in librenms/librenmslibrenms/librenms
Medium, low and unrated 34
- CVE-2023-2995Leyka < 3.30.4 - Admin+ Stored XSSLeyka
- CVE-2023-4376Serial Codes Generator and Validator with WooCommerce Support < 2.4.15 - Admin+ Stored XSSSerial Codes Generator and Validator with WooCommerce Suppo…
- CVE-2023-43566In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configurationJetBrains TeamCity
- CVE-2023-42452Mastodon vulnerable to Stored XSS through the translation featuremastodon
- CVE-2023-42450Mastodon Server-Side Request Forgery vulnerabilitymastodon
- CVE-2023-32182A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSUSE Linux Enterprise Desktop 15 SP5 · SUSE Linux Enterp… +1
- CVE-2023-3892Unsafe XML parsing of 3rd party DICOM private tags may lead to XXEMIM Software MIM Assistant · MIM Software MIM Client
- CVE-2023-4095User enumeration vulnerability in Fujitsu Arconte ÁureaFujitsu Arconte Áurea
- CVE-2023-4094Weak authentication vulnerability in Fujitsu Arconte ÁureaFujitsu Arconte Áurea
- CVE-2023-4093Reflected and persistent XSS vulnerability in Fujitsu Arconte ÁureaFujitsu Arconte Áurea
- CVE-2022-47557Use of Password Hash With Insufficient Computational Effort in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2022-47556Uncontrolled Resource Consumption in Ormazabal productsOrmazabal ekorRCI
- CVE-2023-41834Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF SequencesApache Software Foundation Apache Flink Stateful Functions
- CVE-2023-23957Open Redirection Vulnerability in Symantec Identity Portal 14.4Symantec - A Division of Broadcom Symantec Identity Governa…
- CVE-2023-5054Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/SendingSuper Store Finder
- CVE-2023-26143Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API.blamer
- CVE-2020-24089An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (D
- CVE-2022-28357NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management accougithub.com/nats-io/nats-server · github.com/nats-io/nats-se…
- CVE-2023-31808Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords.
- CVE-2023-36319File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the co
- CVE-2023-38351MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a
- CVE-2023-38352MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in
- CVE-2023-38353MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensit
- CVE-2023-38354MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a
- CVE-2023-38355MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in t
- CVE-2023-38356MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a
- CVE-2023-39575A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitr
- CVE-2023-40931A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrar
- CVE-2023-40932A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom lo
- CVE-2023-40933A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privilege
- CVE-2023-40934A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the
- CVE-2023-41387A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arb
- CVE-2023-41599An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.
- CVE-2023-42399Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via tjodit